High cybersecurity update: New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch. The report references CVE-2026-64531. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked as CVE-2026-64531 (CVSS score: 7.8) and codenamed OVSwrap by its discoverer, was disclosed by security researcher Asim New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Swati Khandelwal Aug 05, 2026 Linux / Vulnerability A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked as CVE-2026-64531 (CVSS score: 7.8) and codenamed OVSwrap by its discoverer, was disclosed by security researcher Asim Manizada on July 28, 2026. The bug sits in the kernel datapath, not the userspace ovs-vswitchd daemon. In a technical write-up , Manizada said an attacker needs "no existing OVS bridge, no running ovs-vswitchd, no host-level CAP_NET_ADMIN." On affected systems where the OVS kernel datapath is available and unprivileged user namespaces are enabled, an ordinary user can create private user and network namespaces with unshare -Urn, gain CAP_NET_ADMIN inside that namespace, and reach the vulnerable flow-installation path. If the openvswitch module is installed but not loaded, resolving its Generic Netlink family name can load it automatically. Where a patched vendor kernel is not yet available, and Open vSwitch is not required, block future module loads; if the module is already resident, unload it or reboot.
Technical Details
The vulnerability identifiers associated with this report are CVE-2026-64531. The highest CVSS score detected in the available material is 7.8. Manizada said he reported the issue to security@kernel.org and the OVS maintainers on June 19. The first fixed upstream releases are Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. The end-of-life 6.13 through 6.17, 6.19, and 7.0 series will not receive upstream stable fixes. Distribution kernels carry backports and downstream changes, so the vendor tracker is the safer source of truth. Open vSwitch stores generated flow actions as Netlink attributes whose nla_len field is 16 bits wide, capping any single nested attribute at 65,535 bytes. The unsafe assignment had existed for 13 years, but a 32 KiB cap on the total generated action stream kept a nested action below the wrap point. The enabling commit's review thread discussed reliability and user-facing failures but did not address the security consequence of removing the guard. An attacker submits a CLONE action packed with hundreds of conntrack sub-actions. On x86-64, the kernel expands each one to 164 bytes, pushing the generated nested action past 65,535 bytes.
Security Impact
Organizations using the affected technology should treat the report according to its high severity classification. The presence of a tracked CVE gives defenders a concrete identifier to use when checking vendor advisories, vulnerability scanners, asset inventories and patch-management systems. Later code trusts that length and resumes parsing from inside attacker-controlled conntrack data, where forged OVS actions are waiting. Manizada described the result as a memory corruption vulnerability with "logic-bug-grade reliability." The exploit chains three primitives from the wraparound: a kernel pointer leak through a fake OUTPUT action, an arbitrary kernel read through a forged tunnel SET action, and a targeted decrement through teardown of a forged tun_dst pointer. It uses those primitives to find a host process's credentials and, on modern kernels, decrement fsuid and fsgid to zero. On success, it corrupts a live kernel credential, modifies /etc/sudoers.d or /etc/sudoers, opens a root shell, and leaves processes and OVS state behind to avoid unsafe teardown. The PoC repository includes records for roughly 800 exact x86-64 kernel builds and attempts dynamic derivation from symbols or BTF for uncovered builds. Manizada's non-exhaustive test matrix found default-config exploitation on tested AlmaLinux 9 and 10, Alpine 3.22 through 3.24, Amazon Linux 2023, Arch, CentOS Stream 9 and 10, Debian 12 and 13, Fedora 42 through 44, Gentoo, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9 and 10, and Ubuntu 22.04. Stock Ubuntu 26.04 blocked the ordinary-user route; disabling its AppArmor user-namespace restriction made the tested systems exploitable.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: High
- CVE: CVE-2026-64531
- CVSS Score: 7.8
- CISA KEV: No match detected in the current catalog.
- Original source: The Hacker News
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from The Hacker News for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
